From f4fc0ef3fbc37bafbd77af36595366a3d19950a1 Mon Sep 17 00:00:00 2001
From: Tod Beardsley <tod_beardsley@rapid7.com>
Date: Thu, 8 Aug 2013 16:22:34 -0500
Subject: [PATCH] Moved classes into the Metasploit3 space

I'm just worried about all those naked classes just hanging around in
the top namespace. This shouldn't impact functionality at all.

While most modules don't define their own classes (this is usually the
job of Msf::Exploit and Rex), I can't think of a reason why you
shouldn't (well, aside from reusability). And yet, very rarely do
modules do it. It's not unknown, though -- the drda.rb capture module
defines a bunch of Constants, and the
post/windows/gather/credentials/bulletproof_ftp.rb module defines some
more interesting things.

So, this should be okay, as long as things are defined in the context of
the Metasploit module proper.
---
 .../http/rails_secret_deserialization.rb      | 172 +++++++++---------
 1 file changed, 86 insertions(+), 86 deletions(-)

diff --git a/modules/exploits/multi/http/rails_secret_deserialization.rb b/modules/exploits/multi/http/rails_secret_deserialization.rb
index 89a7dd290b..ed4e30a62c 100644
--- a/modules/exploits/multi/http/rails_secret_deserialization.rb
+++ b/modules/exploits/multi/http/rails_secret_deserialization.rb
@@ -7,95 +7,95 @@
 
 require 'msf/core'
 
-#Helper Classes copy/paste from Rails4
-class MessageVerifier
-
-	class InvalidSignature < StandardError; end
-
-	def initialize(secret, options = {})
-		@secret = secret
-		@digest = options[:digest] || 'SHA1'
-		@serializer = options[:serializer] || Marshal
-	end
-
-	def generate(value)
-		data = ::Base64.strict_encode64(@serializer.dump(value))
-		"#{data}--#{generate_digest(data)}"
-	end
-
-	def generate_digest(data)
-		require 'openssl' unless defined?(OpenSSL)
-		OpenSSL::HMAC.hexdigest(OpenSSL::Digest.const_get(@digest).new, @secret, data)
-	end
-
-end
-
-class MessageEncryptor
-
-	module NullSerializer #:nodoc:
-
-		def self.load(value)
-			value
-		end
-
-		def self.dump(value)
-			value
-		end
-
-	end
-
-	class InvalidMessage < StandardError; end
-
-	OpenSSLCipherError = OpenSSL::Cipher::CipherError
-
-	def initialize(secret, *signature_key_or_options)
-		options = signature_key_or_options.extract_options!
-		sign_secret = signature_key_or_options.first
-		@secret = secret
-		@sign_secret = sign_secret
-		@cipher = options[:cipher] || 'aes-256-cbc'
-		@verifier = MessageVerifier.new(@sign_secret || @secret, :serializer => NullSerializer)
-		# @serializer = options[:serializer] || Marshal
-	end
-
-	def encrypt_and_sign(value)
-		@verifier.generate(_encrypt(value))
-	end
-
-	def _encrypt(value)
-		cipher = new_cipher
-		cipher.encrypt
-		cipher.key = @secret
-		# Rely on OpenSSL for the initialization vector
-		iv = cipher.random_iv
-		#encrypted_data = cipher.update(@serializer.dump(value))
-		encrypted_data = cipher.update(value)
-		encrypted_data << cipher.final
-		[encrypted_data, iv].map {|v| ::Base64.strict_encode64(v)}.join("--")
-	end
-
-	def new_cipher
-		OpenSSL::Cipher::Cipher.new(@cipher)
-	end
-
-end
-
-class KeyGenerator
-
-	def initialize(secret, options = {})
-		@secret = secret
-		@iterations = options[:iterations] || 2**16
-	end
-
-	def generate_key(salt, key_size=64)
-		OpenSSL::PKCS5.pbkdf2_hmac_sha1(@secret, salt, @iterations, key_size)
-	end
-
-end
-
 class Metasploit3 < Msf::Exploit::Remote
 	Rank = ExcellentRanking
 
+	#Helper Classes copy/paste from Rails4
+	class MessageVerifier
+
+		class InvalidSignature < StandardError; end
+
+		def initialize(secret, options = {})
+			@secret = secret
+			@digest = options[:digest] || 'SHA1'
+			@serializer = options[:serializer] || Marshal
+		end
+
+		def generate(value)
+			data = ::Base64.strict_encode64(@serializer.dump(value))
+			"#{data}--#{generate_digest(data)}"
+		end
+
+		def generate_digest(data)
+			require 'openssl' unless defined?(OpenSSL)
+			OpenSSL::HMAC.hexdigest(OpenSSL::Digest.const_get(@digest).new, @secret, data)
+		end
+
+	end
+
+	class MessageEncryptor
+
+		module NullSerializer #:nodoc:
+
+			def self.load(value)
+				value
+			end
+
+			def self.dump(value)
+				value
+			end
+
+		end
+
+		class InvalidMessage < StandardError; end
+
+		OpenSSLCipherError = OpenSSL::Cipher::CipherError
+
+		def initialize(secret, *signature_key_or_options)
+			options = signature_key_or_options.extract_options!
+			sign_secret = signature_key_or_options.first
+			@secret = secret
+			@sign_secret = sign_secret
+			@cipher = options[:cipher] || 'aes-256-cbc'
+			@verifier = MessageVerifier.new(@sign_secret || @secret, :serializer => NullSerializer)
+			# @serializer = options[:serializer] || Marshal
+		end
+
+		def encrypt_and_sign(value)
+			@verifier.generate(_encrypt(value))
+		end
+
+		def _encrypt(value)
+			cipher = new_cipher
+			cipher.encrypt
+			cipher.key = @secret
+			# Rely on OpenSSL for the initialization vector
+			iv = cipher.random_iv
+			#encrypted_data = cipher.update(@serializer.dump(value))
+			encrypted_data = cipher.update(value)
+			encrypted_data << cipher.final
+			[encrypted_data, iv].map {|v| ::Base64.strict_encode64(v)}.join("--")
+		end
+
+		def new_cipher
+			OpenSSL::Cipher::Cipher.new(@cipher)
+		end
+
+	end
+
+	class KeyGenerator
+
+		def initialize(secret, options = {})
+			@secret = secret
+			@iterations = options[:iterations] || 2**16
+		end
+
+		def generate_key(salt, key_size=64)
+			OpenSSL::PKCS5.pbkdf2_hmac_sha1(@secret, salt, @iterations, key_size)
+		end
+
+	end
+
 	include Msf::Exploit::CmdStagerTFTP
 	include Msf::Exploit::Remote::HttpClient